Kingdom: Environment

This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms.

GCP Terraform Misconfiguration: GKE Container-Optimized OS Not In Use

Abstract

A Terraform configuration sets up GKE nodes that do not run Container-Optimized OS.

Explanation

By default, GKE nodes run with Container-Optimized OS (COS). COS is an operating system image that is optimized to run GKE nodes on Google Compute Engine instances. Opting out of the default forgoes the benefits of enhanced security and efficiency.

Example 1: The following example Terraform configuration sets up a pool of GKE nodes that do not run COS because image_type is set to a non-COS image in the node_config block.


resource "google_container_node_pool" "node_pool_demo" {
  ...
  node_config {
    image_type = "UBUNTU"
    ...
  }
  ...
}

References

[1] HashiCorp google_container_node_pool

[2] Google Cloud Setting the default node image type

[3] Google Cloud Container-Optimized OS Overview

[4] Standards Mapping - CIS Google Kubernetes Engine Benchmark Recommendation 5.5.1

[5] Standards Mapping - FIPS200 CM

[6] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-2 Flaw Remediation (P1)

[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-2 Flaw Remediation

[9] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[10] Standards Mapping - OWASP Top 10 2017 A9 Using Components with Known Vulnerabilities

[11] Standards Mapping - OWASP Top 10 2021 A06 Vulnerable and Outdated Components

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.2

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.3.3

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.3.3

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 10.2 - Threat and Vulnerability Management

[16] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 10.2 - Threat and Vulnerability Management

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 10.2 - Threat and Vulnerability Management, Control Objective C.1.6 - Web Software Components & Services

desc.structural.hcl.gcp_terraform_misconfiguration_gke_container_optimized_os_not_in_use